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CONTRACT  AUDITS 

Role  in  Helping  Ensure  Effective  Oversight  and 
Reducing  Improper  Payments 


Why  GAO  Did  This  Study 


What  GAO  Found 


Agencies  across  the  government  are 
increasingly  reliant  on  contractors  to 
execute  their  missions.  With 
hundreds  of  billions  of  taxpayer 
dollars  at  stake,  the  government 
needs  strong  controls  to  provide 
reasonable  assurance  that  these 
contract  funds  are  not  being  lost  to 
improper  payments  (fraud  and 
errors),  waste,  and  mismanagement. 

Effective  contract  oversight,  which 
includes  effective  internal  controls 
throughout  the  contracting  process, 
is  essential  to  protecting  government 
and  taxpayer  interests.  Standards  for 
Internal  Control  in  the  Federal 
Government  provides  the  overall 
framework  for  internal  control, 
which  includes  the  control 
environment,  risk  assessment, 
control  activities,  information  and 
communication,  and  monitoring. 

Contract  auditing  is  a  control 
mechanism  intended  to  provide  those 
responsible  for  government 
procurement  with  financial 
information  and  advice  relating  to 
contractual  matters  and  the 
effectiveness,  efficiency,  and 
economy  of  contractors’  operations. 

Today’s  testimony  describes  the  (1) 
contracting  cycle  and  related  internal 
controls,  (2)  Defense  Contract  Audit 
Agency  (DCAA)  and  its  role  in 
performing  contract  audits  for  the 
Department  of  Defense  (DOD)  and 
other  federal  agencies,  and  (3)  risks 
associated  with  ineffective  contract 
controls  and  auditing. 

GAO’s  testimony  is  based  on  prior 
reports  and  testimonies,  as  listed  at 
the  end  of  this  statement. 

View  GAO-1 1  -331 T  or  key  components. 

For  more  information,  contact  Jeanette  M. 
Franzel  at  (202)  512-9471  or 
franzelj@gao.gov. 


The  contracting  cycle  consists  of  activities  throughout  the  acquisition  process, 
including  preaward  and  award,  contract  administration  and  management,  and 
ultimately  the  contract  closeout.  Strong  internal  controls  contain  a  balance  of 
preventive  and  detective  controls  appropriate  for  the  agency’s  operation  and 
help  ensure  an  effective  contract  oversight  process.  Preventive  controls — 
such  as  invoice  review  prior  to  payment — are  controls  designed  to  prevent 
improper  payments,  waste,  and  mismanagement,  while  detective  controls — 
such  as  incurred  cost  audits — are  designed  to  identify  improper  payments 
after  the  payment  is  made.  While  detective  controls  identify  funds  that  may 
have  been  inappropriately  paid  and  should  be  returned  to  the  government, 
preventive  controls  help  to  reduce  the  risk  of  improper  payments  or  waste 
before  they  occur. 

DOD  accounts  for  the  largest  share  of  federal  contract  spending.  DCAA  was 
established  in  1965  in  response  to  studies  which  identified  the  need  for 
consistency  in  contract  audits  at  DOD.  DCAA  serves  a  critical  role  in  DOD  and 
other  federal  agency  contractor  oversight  by  providing  auditing,  accounting, 
and  financial  advisory  services  in  connection  with  the  negotiation, 
administration,  and  closeout  of  contracts  and  subcontracts.  The  majority  of 
DCAA  audits  focus  on  cost-reimbursable  and  other  nonfixed-price  contracts, 
which  pose  the  highest  risk  to  the  government. 

Reported  federal  contract  obligations — which  have  increased  by  $100  billion 
in  real  terms  since  fiscal  year  2005,  from  $435  billion  to  $535  billion  in  fiscal 
year  2010 — poses  significant  risk  if  effective  contract  oversight  is  not  in  place. 
GAO’s  work  has  identified  contract  management  weaknesses,  significant 
problems  with  federal  agency  controls  over  contract  payments,  and  internal 
control  deficiencies  throughout  the  contracting  process,  including  contract 
auditing.  GAO  also  found  audit  quality  problems  at  DCAA  offices  nationwide, 
including  compromise  of  auditor  independence,  insufficient  audit  testing,  and 
inadequate  planning  and  supervision. 

DCAA  and  the  other  federal  agencies  mentioned  in  GAO’s  testimony  have 
completed  some  actions  and  have  actions  under  way  to  address  GAO’s 
recommendations.  GAO  madel7  recommendations  to  DOD  and  the  DOD 
Inspector  General  (IG)  to  address  the  weaknesses  it  identified  at  DCAA.  DOD 
and  DCAA  have  taken  a  number  of  actions  on  these  recommendations, 
including  revising  DCAA’s  mission  statement,  appointing  a  new  DCAA 
Director  and  a  Western  Region  Director,  establishing  an  internal  review  office 
to  perform  periodic  internal  evaluations  and  address  hotline  complaints, 
initiating  outside  hiring,  strengthening  its  audit  quality  review  function,  and 
providing  training  on  auditing  standards.  DCAA  has  actions  under  way  on 
other  recommendations.  DOD  IG  has  expanded  its  oversight  of  DCAA’s  audit 
quality  control  process.  In  addition,  the  Centers  for  Medicare  and  Medicaid 
Services  (CMS)  have  completed  actions  on  two  recommendations  and  expect 
to  complete  actions  on  all  but  one  of  the  remaining  16  recommendations  by 
March  31,  2011.  Department  of  Energy  official’s  stated  that  actions  have  been 
complete  on  all  11  GAO  recommendations.  GAO  is  following  up  to  confirm. 
_ United  States  Government  Accountability  Office 


Madam  Chairman  and  Members  of  the  Subcommittee: 


Thank  you  for  the  opportunity  to  be  here  today  to  discuss  the  role  that 
contract  audits  can  serve  in  contract  oversight  processes  and  helping  to 
reduce  the  risk  of  improper  payments.  The  purpose  of  contract  auditing  is 
to  assist  in  achieving  prudent  contracting  by  providing  those  responsible 
for  government  procurement  with  financial  information  and  advice 
relating  to  contractual  matters  and  the  effectiveness,  efficiency,  and 
economy  of  contractors’  operations.  With  reported  federal  contract 
spending  topping  the  $500  billion  mark  annually,  effective  contract 
oversight,  which  includes  effective  internal  control  throughout  the 
contracting  process,  is  essential  to  protecting  the  government  and 
taxpayer  interests.  The  Standards  for  Internal  Control  in  the  Federal 
Government  provide  the  overall  framework  for  establishing  and 
maintaining  internal  control  and  for  identifying  and  addressing  areas  at 
greatest  risk  of  fraud,  waste,  abuse,  and  mismanagement. 1 

Today,  I  will  describe  the  (1)  contracting  cycle  and  the  general  nature  of 
internal  controls  that  should  be  in  place,  (2)  Defense  Contract  Audit 
Agency  (DCAA)  and  its  role  in  performing  contract  audits,  and  (3)  risks 
associated  with  ineffective  contract  controls  and  auditing.  I  will  conclude 
by  outlining  some  potential  actions  that  could  improve  the  effectiveness  of 
DCAA  and  its  role  in  performing  contract  audits  for  the  Department  of 
Defense  (DOD)  and  other  federal  agencies. 

In  preparing  this  testimony,  we  relied  on  the  work  we  performed  during 
our  DCAA  engagements,2  as  well  as  our  extensive  body  of  work  on  federal 
agency  contract  management.  More  detail  on  our  scope  and  methodology 
is  included  in  each  issued  product.  Our  audit  work  was  conducted  in 
accordance  with  generally  accepted  government  auditing  standards 


1  GAO,  Standards  for  Internal  Control  in  the  Federal  Government,  GAO/AIMD-OO-2 1.3.1 
(November  1999). 

2  GAO,  Defense  Management:  Widespread  DCAA  Audit  Problems  Leave  Billions  of 
Taxpayer  Dollars  Vulnerable  to  Fraud,  Waste,  Abuse,  and  Mismanagement,  GAO-10-163T 
(Washington,  D.C.:  Oct.  15,  2009);  DCAA  Audits:  Widespread  Problems  with  Audit  Quality 
Require  Significant  Reform,  GAO-09-468  (Washington,  D.C.:  Sept.  23,  2009);  DCAA 
Audits:  Widespread  Problems  with  Audit  Quality  Require  Significant.  Reform, 
GAO-09-1009T  (Washington,  D.C.:  Sept.  23,  2009);  DCAA  Audits:  Allegations  that  Certain 
Audits  at  Three  Locations  Did  Not  Meet  Professional  Standards  Were  Substantiated, 
GAO-08-993T  (Washington,  D.C.:  Sept.  10,  2008);  DCAA  Audits:  Allegations  that  Certain 
Audits  at  Three  Locations  Did  Not  Meet  Professional  Standards  Were  Substantiated, 
GAO-08-857  (Washington,  D.C.:  July  22,  2008). 


Page  1 


GAO-11-331T 


(GAGAS).  Those  standards  require  that  we  plan  and  perform  our  audits  to 
obtain  sufficient,  appropriate  evidence  to  provide  a  reasonable  basis  for 
our  findings  and  conclusions  based  on  our  audit  objectives.  We  believe 
that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings 
and  conclusions  based  on  our  audit  objectives. 


The 

and 


Contracting  Cycle 
Internal  Controls 


The  contracting  cycle  consists  of  activities  throughout  the  acquisition 
process,  including  preaward  and  award,  contract  administration  and 
management,  and  ultimately  the  contract  closeout.  Generally,  prior  to 
contract  award,  an  agency  identifies  a  need;  develops  a  requirements 
package;  determines  the  method  of  acquisition;  solicits  and  evaluates  bids 
or  proposals;  determines  the  adequacy  of  the  contractor’s  accounting 
system  for  billing  purposes;  and  ultimately  negotiates  a  price  and  contract 
terms,  resulting  in  the  contract  awards.  After  contract  award,  the  agency 
performs  activities  related  to  contract  administration  and  management. 
Contract  administration  and  management  involves  monitoring  the 
contractor’s  performance  as  well  as  reviewing  and  approving  (or 
disapproving)  the  contractor’s  requests  for  payments.  As  discussed  in 
more  detail  later  in  this  statement,  there  are  various  types  of  contract 
audit  activities  that  can  occur  in  the  preaward  and  award,  and 
administration  and  management  phases  of  a  contract.  The  contract 
closeout  process  involves  verifying  that  the  goods  or  services  were 
provided  and  that  administrative  matters  are  completed,  including  a 
contract  audit  of  costs  billed  to  the  government  and  adjusting  for  any  over- 
or  underpayments  based  on  the  final  invoice.  Effective  contract  oversight 
includes  effective  internal  control  throughout  the  contracting  process. 


Internal  Control  Generally,  the  government  manages  its  risk,  in  part,  through  establishing 

effective  internal  controls,  which  includes  performing  oversight  activities. 
Standards  for  Internal  Control  provides  that  to  be  effective,  an  entity’s 
management  should  establish  both  a  supportive  overall  control 
environment  and  specific  control  activities  directed  at  carrying  out  its 
objectives.3  As  such,  an  entity’s  management  should  establish  and 
maintain  an  environment  that  sets  a  positive  and  supportive  attitude 
towards  control  and  conscientious  management.  A  positive  control 


3  Standards  f  or  Internal  Control  cover  the  control  environment,  risk  assessment,  control 
activities  (policies,  procedures,  techniques,  and  mechanisms  that  enforce  management’s 
directives),  information  and  communication,  and  monitoring  (performance  assessments 
and  audits). 


Page  2 


GAO-11-331T 


environment  provides  discipline  and  structure  as  well  as  a  climate 
supportive  of  quality  internal  control,  and  includes  an  assessment  of  the 
risks  the  agency  faces  from  both  external  and  internal  sources.  Control 
activities  are  the  policies,  procedures,  techniques,  and  mechanisms  that 
enforce  management’s  directives  and  help  ensure  that  actions  are  taken  to 
address  risks.  The  standards  further  provide  that  information  should  be 
recorded  and  communicated  to  management  and  oversight  officials  in  a 
form  and  within  a  time  frame  that  enables  them  to  carry  out  their 
responsibilities.  Finally,  an  entity  should  have  internal  control  monitoring 
activities  in  place  to  assess  the  quality  of  performance  over  time  and 
ensure  that  the  findings  of  audits  and  other  reviews  are  promptly  resolved. 

Control  activities  include  both  preventive  and  detective  controls. 
Preventive  controls — such  as  invoice  review  prior  to  payment — are 
controls  designed  to  prevent  improper  payments  (errors  and  fraud),4 
waste,  and  mismanagement,  while  detective  controls — such  as  incurred 
cost  audits — are  designed  to  identify  errors  or  improper  payments  after 
the  payment  is  made.  A  sound  system  of  internal  control  contains  a 
balance  of  both  preventive  and  detective  controls  that  is  appropriate  for 
the  agency’s  operations.  While  detective  controls  are  beneficial  in  that 
they  identify  funds  that  may  have  been  inappropriately  paid  and  should  be 
returned  to  the  government,  preventive  controls  such  as  accounting 
system  reviews  and  invoice  reviews  help  to  reduce  the  risk  of  improper 
payments  or  waste  before  they  occur.  A  key  concept  in  the  standards  is 
that  the  cost  of  control  activities  should  not  outweigh  the  benefit. 
Generally,  it  is  more  effective  and  efficient  to  prevent  improper  payments. 
A  control  activity  can  be  preventive,  detective,  or  both,  based  on  when  the 
control  occurs  in  the  contract  life  cycle. 


4  Improper  payments  are  defined  in  the  Improper  Payments  Information  Act  of  2002  as  any 
payment  that  should  not  have  been  made  or  that  was  made  in  an  incorrect  amount 
(including  overpayments  and  underpayments)  under  statutory,  contractual,  administrative, 
or  other  legally  applicable  requirements.  It  also  includes  any  payment  to  an  ineligible 
recipient  or  ineligible  service,  duplicate  payments,  payments  for  services  not  received,  and 
any  payment  for  an  incorrect  amount. 
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Contract  Types  and 
Related  Risks 


Agencies  may  choose  among  different  contract  types  to  acquire  goods  and 
services.5  This  choice  is  the  principal  means  that  agencies  have  for 
allocating  risk  between  the  government  and  the  contractor.  The  choice  of 
a  contract  type  will  also  impact  the  types  of  internal  control  and  contract 
auditing  activities  needed  to  help  protect  the  government’s  interests  and 
reduce  the  risk  of  improper  payments.  Contract  types  can  be  grouped  into 
two  broad  categories:  fixed-price  contracts  and  nonfixed-price  contracts, 
such  as  cost-reimbursable  contracts  and  time  and  materials  (T&M) 
contracts.  Although  the  Federal  Acquisition  Regulation  (FAR)  places 
limitations  on  the  use  of  cost-reimbursement  and  T&M  contract  types, 
these  contract  types  may  be  used  to  provide  the  flexibility  needed  by  the 
government  to  acquire  the  large  variety  and  volume  of  supplies  and 
services  it  needs.  The  three  types  of  contracts  place  different  levels  of  risk 
on  the  government  and  the  contractor.  For  example, 

•  For  fixed-price  contracts,  the  government  agrees  to  pay  a  set  price  for 
goods  or  services  regardless  of  the  actual  cost  to  the  contractor.  A 
fixed-price  contract  is  ordinarily  in  the  government’s  interest  when  the 
risks  involving  the  project  and  the  project’s  price  are  minimal  or  can 
be  predicted  with  an  acceptable  degree  of  certainty  and  a  sound  basis 
for  pricing  exists,  as  the  contractor  assumes  the  risk  for  cost  overruns. 

•  Under  cost-reimbursement  contracts,  the  government  agrees  to  pay 
those  costs  of  the  contractor  that  are  allowable,  reasonable,  and 
allocable  to  the  extent  prescribed  by  the  contract.  Consequently,  the 
government  assumes  most  of  the  cost  risk.  The  contractor  is  required 
to  provide  its  best  effort  to  meet  contract  objectives  within  the 
estimated  cost.  If  this  cannot  be  done,  the  government  can  provide 
additional  funds  to  complete  the  effort,  decide  not  to  provide 
additional  funds,  or  terminate  the  contract.  Cost-reimbursement 
contracts  may  be  used  only  when  the  contractor’s  accounting  system 
is  adequate  for  determining  costs  applicable  to  the  contract  and 
appropriate  government  surveillance  during  contract  performance  will 
provide  reasonable  assurance  that  efficient  methods  and  effective  cost 
controls  are  used.6  In  order  to  determine  if  the  contractor  has  efficient 
methods  and  effective  cost  controls,  contracting  officers  and  other 


5  Agencies  may  acquire  goods  and  services  under  contracts  with  private  entities  or  they 
may  enter  into  interagency  agreements  (interagency  acquisitions)  to  acquire  goods  and 
services  from  other  federal  agencies,  which  may  acquire  the  goods  and  services  under 
contracts  with  private  entities. 

6  48  C.F.R.  §§  16.104(h),  16.301-3(a). 
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contracting  oversight  personnel  may  perform  reviews  of  various 
contractor  systems,  as  well  as  a  comprehensive  review  of  contractor 
invoices  to  determine  if  the  contractor  is  billing  costs  in  accordance 
with  the  contract  terms  and  applicable  government  regulations.  In 
addition,  the  establishment  of  provisional  and  final  indirect  cost  rates 
helps  to  ensure  that  the  government  makes  payments  for  costs  that  are 
allowable,  reasonable,  and  allocable  to  the  extent  prescribed  by  the 
contract. 

•  For  T&M  contracts,  the  government  agrees  to  pay  fixed,  per-hour  labor 
rates  and  to  reimburse  other  costs  directly  related  to  the  contract, 
such  as  materials,  equipment,  or  travel,  based  on  cost.  Like  cost- 
reimbursement  contracts,  the  government  assumes  the  cost  risk 
because  the  contractor  is  only  required  to  make  a  good  faith  effort  to 
meet  the  government’s  needs  within  a  ceiling  price.  A  T&M  contract 
may  be  used  only  if  the  contracting  officer  prepares  a  determination 
and  findings  that  no  other  contract  type  is  suitable  and  if  the  contract 
includes  a  ceiling  price  that  the  contractor  exceeds  at  its  own  risk.7  In 
addition,  since  these  contracts  provide  no  positive  profit  incentive  for 
the  contractor  to  control  costs  or  use  labor  efficiently,  the  government 
must  conduct  appropriate  surveillance  of  contractor  performance  to 
ensure  efficient  methods  and  effective  cost  controls  are  being  used. 

As  discussed  in  more  detail  later  in  this  statement,  most  contract  audit 
activity  is  focused  on  cost-reimbursable  and  other  nonfixed-price 
contracts,  due  to  the  higher  risks  to  the  federal  government. 


DCAA’s  Origin  and 
Contract  Audit  Role 


Audits  of  military  contracts  can  be  traced  back  to  at  least  the  World  War  I 
era.  Initially,  the  various  branches  of  the  military  had  their  own  contract 
audit  function  and  associated  instructions  and  accounting  rulings. 
Contractors  and  government  personnel  recognized  the  need  for 
consistency  in  both  contract  administration  and  audit.  The  Navy  and  the 
Army  Air  Corps  made  the  first  attempt  to  perform  joint  audits  in  1939.  By 
December  1942,  the  Navy,  the  Army  Air  Corps,  and  the  Ordnance 
Department  had  established  audit  coordination  committees  for  selected 
areas  where  plants  were  producing  different  items  under  contracts  for 
more  than  one  service.  On  June  18,  1952,  the  three  military  services  jointly 
issued  a  contract  audit  manual  that  later  became  the  DCAA  Contract 


7  48  C.F.R.  §  16.601(d). 
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Audit  Manual  (CAM).8  The  CAM  has  been  regularly  updated  over  the 
years  and  is  still  in  use  today. 

In  May  1962,  Secretary  of  Defense  Robert  S.  McNamara  instituted  “Project 
60”  to  examine  the  feasibility  of  centrally  managing  the  field  activities 
concerned  with  contract  administration  and  audit.9  An  outcome  of  this 
study  was  the  decision  to  establish  a  single  contract  audit  capability  within 
DOD  and  DCAA  was  established  on  June  8,  1965. 10  At  that  time,  DCAA’s 
mission  was  to  perform  all  necessary  contract  audits  for  DOD  and  provide 
accounting  and  financial  advisory  services  regarding  contracts  and 
subcontracts  to  all  DOD  components  responsible  for  procurement  and 
contract  administration.  DCAA  was  placed  under  management  control  of 
the  Under  Secretary  of  Defense  (Comptroller),  where  it  remains  today. 
Other  audit  organizations,  including  the  DOD  and  other  federal  agency 
Inspectors  General  (IG),  the  Special  IGs  for  Iraq  and  Afghanistan,  and  the 
military  service  audit  agencies  also  have  a  role  in  the  oversight  of  federal 
contracts. 

DCAA  consists  of  a  headquarters  office  at  Fort  Belvoir,  Virginia,  and  six 
major  organizational  components — a  field  detachment  office,  which 
handles  audits  of  classified  contracting  activity,  and  five  regional  offices 
within  the  United  States.  The  regional  offices  manage  field  audit  offices 
(FAO),  which  are  identified  as  branch  offices,  resident  offices,  or 
suboffices.  Resident  offices  are  located  at  larger  contractor  facilities  in 
order  to  facilitate  DCAA  audit  work.  In  addition,  regional  office  directors 
can  establish  suboffices  as  extensions  of  FAOs  to  provide  contract  audit 
services  more  economically.  A  suboffice  depends  on  its  parent  FAO  for 
release  of  audit  reports  and  other  administrative  support.  In  total,  there 
are  currently  382  DCAA  offices,  including  114  FAOs,  throughout  the 
United  States  and  overseas.  At  the  end  of  fiscal  year  2010,  DCAA  employed 
about  4,700  staff,  of  which  85  percent  are  auditors,  at  DCAA’s  various 
offices  throughout  the  United  States,  Europe,  the  Middle  East,  and  in  the 


8  DCAA,  Contract  Audit  Manual  (CAM)  DCAAM  7640.1. 

9  Project  60  also  resulted  in  consolidation  of  the  military  services’  contract  management 
activities  under  the  Defense  Contract  Management  Agency  (DCMA),  formerly  the  Defense 
Contract  Management  Command  (DCMC)  within  the  Defense  Logistics  Agency.  On  March 
27,  2000,  DCMC  was  established  as  DCMA  under  the  authority  of  the  Under  Secretary  of 
Defense  (Acquisition,  Technology,  and  Logistics). 

10  DOD,  General  Plan:  Consolidation  of  Department  of  Defense  Contract  Audit  Activities 
into  the  Defense  Contract  Audit  Agency  (Feb.  17,  1965). 
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Pacific  to  perform  audits  and  provide  nonaudit  services  in  support  of 
contract  negotiations  related  to  approximately  9,000  contractors. 

DCAA  contract  audits  are  intended  to  be  a  key  control  to  help  ensure  that 
prices  paid  by  the  government  for  needed  goods  and  services  are  fair  and 
reasonable  and  that  contractors  are  charging  the  government  in 
accordance  with  applicable  laws,  the  Federal  Acquisition  Regulation 
(FAR),  Cost  Accounting  Standards  (CAS),  and  contract  terms.  DCAA’s 
mission  encompasses  both  audit  and  nonaudit  services  in  support  of  DOD 
and  other  federal  agencies’  contracting  and  contract  payment  functions. 
FAR  subpart  42.1,  “Contract  Audit  Services,”  and  DOD  Directive  5105.36, 
Defense  Contract  Audit  Agency  (DCAA),  establish  DCAA  as  the 
department’s  contract  audit  agency11  and  set  forth  DCAA’s  responsibilities. 

FAR  42.101  prescribes  contract  audit  responsibilities  as  submitting 
information  and  advice  to  the  requesting  activity,  based  on  the  analysis  of 
contractor  financial  and  accounting  records  or  other  related  data  as  to  the 
acceptability  of  the  contractors’  incurred  and  estimated  costs;  reviewing 
the  financial  and  accounting  aspects  of  contractor  cost  control  systems; 
and  performing  other  analyses  and  reviews  that  require  access  to 
contractor  financial  and  accounting  records  supporting  proposed  and 
incurred  costs. 

DOD’s  acquisition  life  cycle  includes  many  contract  and  administrative 
activities.  As  illustrated  in  figure  1,  these  activities  fall  into  three  contract 
phases — preaward  and  award,  administration  and  management,  and 
closeout — that  involve  several  activities  and  numerous  types  of  audits. 
DCAA  and  other  federal  agencies  are  not  consistent  in  their  definitions  of 
contract  audits  and  reviews  and  other  federal  agencies  generally  do  not 
perform  the  full  range  of  audits  that  DCAA  performs.  While  the  majority  of 
DCAA’s  audit  effort  supports  the  DOD  contract  community,  in  fiscal  year 
2010,  based  on  DCAA  records,  about  12  percent  of  DCAA’s  audit  hours 
were  used  to  respond  to  other  federal  agency  requests  for  contractor 
audits.  DCAA  performs  audit  services  for  other  federal  agencies  on  a  fee- 
for-service  basis.  Appendix  I  contains  information  on  DCAA  audits  and 
nonaudit  services  provided  by  DCAA  in  support  of  contracting  and 
contract  payment. 


11  DODD  5105.36,  paragraph  4.2,  reissued  on  January  4,  2010,  to  include  DCAA’s  new 
mission  statement.. 
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Figure  1 :  Relationship  of  Contract  Phases,  Contract  Events,  and  DCAA  Audits 
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Source:  GAO  analysis  of  DCAA  information. 


The  majority  of  DCAA  audits  focus  on  cost-reimbursable  and  other 
nonfixed-price  contracts,  including  progress  payments  on  major  weapon 
systems  and  time-and-materials  contracts.  These  contract  types  pose  the 
highest  risk  to  the  government  because  the  government  is  generally  not 
promised  a  completed  deliverable  or  service  at  a  set  price.  DCAA  audits  of 
contractor  business  systems  and  related  internal  controls  support 
decisions  on  pricing,  contract  awards,  and  billing.  For  example,  the  FAR 
requires  government  contracting  officers  to  determine  the  adequacy  of  a 
contractor’s  accounting  system  before  awarding  a  cost-reimbursement  or 
other  nonfixed-price  contract.12  Audits  of  estimating  system  controls 
support  negotiation  of  fair  and  reasonable  prices. 13  Also,  billing  system 
audits  support  decisions  to  authorize  contractors  to  submit  invoices 


12  FAR  §§  16.104(h)  and  16.301-3(a)(l). 

13  DCAA,  Contract  Audit  Manual  (CAM)  6-1202.1. a  and  Defense  Federal  Acquisition 
Regulation  Supplement  (DFARS)  §  215.407-5. 
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directly  to  DOD  payment  offices  for  payment  without  government 
review. 14  Internal  control  audits  also  impact  the  planning  and  reliability  of 
other  DCAA  audits,  such  as  audits  of  contractors’  pricing  proposals  and 
annual  incurred  cost  claims,  because  DCAA  uses  the  results  of  its  internal 
control  audits  to  assess  risk  and  plan  the  nature,  extent,  and  timing  of 
tests  for  these  audits. 


Risks  of  Ineffective 
Contract  Controls  and 
Auditing 


Agencies  across  the  government  are  increasingly  reliant  on  contractors  to 
execute  their  missions.  In  fiscal  year  2010,  federal  agencies  reported 
obligating  approximately  $535  billion  on  goods  and  services — more  than 
double  the  amount  obligated  at  the  start  of  the  last  decade  in  real  terms. 
Our  analysis  of  Federal  Procurement  Data  System-Next  Generation 
(FPDS-NG)  contract  obligations15  determined  that  although  federal 
contract  spending  increases  have  slowed  and  decreased  slightly  in  recent 
years,  over  the  past  5  years  federal  contract  spending  has  increased  by 
$100  billion.16  As  illustrated  in  figure  2,  the  sheer  size  of  federal  contract 
spending  poses  significant  risk  if  effective  processes,  controls,  and 
oversight  are  not  in  place.  DOD  accounts  for  approximately  70  percent  of 
the  federal  government’s  FPDS-NG  reported  annual  contract  spending — 
$367  billion  in  fiscal  year  2010 — and  other  federal  agencies  accounted  for 
$168  billion  in  contract  spending.  With  hundreds  of  billions  in  taxpayer 
dollars  spent  on  government  contracts,  strong  contract  oversight  is 
essential. 


14  FAR  §  42.101  and  DFARS  §  242.803. 

15  The  obligation  amount  generally  is  the  amount  of  the  contract  award,  such  as  the  firm- 
fixed  price  or  estimated  value  of  cost  reimbursements  for  a  particular  fiscal  year. 

16  Our  analysis  is  based  on  contract  actions  over  $25,000  adjusted  for  fiscal  year  2010 
inflation  factor. 
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Figure  2:  DOD  and  Other  Federal  Agency  Contract  Obligations  Related  to  Actions 
over  $25,000  for  Fiscal  Years  2005  through  201 0a 


Dollars  In  billions 
600 


| _ |  Other  federal  agency  contract  obligations 

DOD  contract  obligations 

Source:  GAO  analysis  of  unaudited  obligations  data  from  the  Federal  Procurement  Data  System. 

“Contract  obligations  are  adjusted  for  inflation  using  the  fiscal  year  2010  Gross  Domestic  Price  Index. 

bDOD’s  reported  obligations  in  fiscal  year  2008  and  2009  reflected  an  approximately  $13.9  billion 
adjustment  to  correct  an  error  made  in  fiscal  year  2008. 

GAO’s  work  has  shown  that  agencies  confront  several  interrelated 
challenges,  including  separating  wants  from  needs;  executing  acquisition 
programs  within  available  funding  and  established  time  frames;  using 
sound  contracting  arrangements  with  appropriate  incentives  and  effective 
oversight;  assuring  that  contractors  are  used  only  in  appropriate 
circumstances  and  play  proper  roles;  and  sustaining  a  capable  and 
accountable  acquisition  workforce.  In  addition,  since  1997,  we  have 
reported  that  the  nonacquisition  workforce,  such  as  contracting  officer 
representatives  and  unit  leaders,  also  have  a  role  in  contract  management 
and  must  be  trained. 

These  challenges  have  contributed  to  GAO’s  designating  contract 
management  as  a  high-risk  area  at  DOD,  the  Department  of  Energy,  and 
the  National  Aeronautical  and  Space  Administration.  Weapon  system 
acquisition  is  also  designated  as  a  high-risk  area  at  DOD.  Governmentwide, 
GAO  also  designated  the  management  and  use  of  interagency  contracting 
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as  high  risk.  Other  agencies  face  many  of  the  same  challenges. 
Collectively,  these  challenges  expose  hundreds  of  billions  of  taxpayer 
dollars  to  potential  risks  of  improper  payments,  waste,  and 
mismanagement. 


Contracting  Control  Our  work  has  identified  significant  contract  management  weaknesses, 

Weaknesses  Identified  in  problems  with  federal  agency  controls  over  contract  payments  ,  as  well  as 

GAO  Work  weaknesses  in  contract  auditing. 17  We  have  identified  internal  control 

deficiencies  that  have  occurred  throughout  the  contracting  process  and 
phases.  These  weaknesses  and  deficiencies  increase  the  risk  of  improper 
payments,  and  fraud,  waste,  abuse,  and  mismanagement.  For  example,  we 
found: 

Department  of  Energy  (DOE).  DOE’s  internal  controls  over  payments 
to  its  Waste  Treatment  Plant  (WTP)  contractor  did  not  provide  reasonable 
assurance  against  the  risk  of  improper  payments,  particularly  given  the 
WTP  project’s  substantial  inherent  risks. 18  Several  factors  combine  to  pose 
an  inherent  risk  to  the  government  of  improper  payments  on  this  project, 
including  the  size  and  complexity  of  this  one-of-a-kind  nuclear 
construction  project,  the  multibillion-dollar  cost  and  schedule  overruns 
the  project  had  already  experienced,  and  the  substantial  volume  of 
transactions  billed  by  the  contractor  to  DOE  on  each  invoice.  Despite 
these  risks,  in  fiscal  years  2005  and  2006,  DOE  performed  little  or  no 
review  of  the  contractor’s  invoices  or  supporting  documents  for  $40 
million  to  $60  million  billed  by  the  contractor  to  DOE  each  month.  The 
need  for  close,  ongoing  review  of  invoiced  transactions  and  support  is 
particularly  compelling  given  that  the  contractor’s  invoices  provided  little 
detail  as  to  the  items  purchased,  contrary  to  FAR  and  contract 
requirements.  However,  DOE  officials  chose  instead  to  rely  primarily  on 
DCAA’s  review  and  approval  of  the  contractor’s  corporatewide  financial 
systems,  which  DOE  officials  believed  allowed  them  to  rely  on  the 
contractor’s  systems  with  little  or  no  DOE  oversight.  In  addition,  DOE 
relied  primarily  on  the  contractor  to  review  and  validate  subcontractor 
charges  without  having  a  process  in  place  to  assess  whether  the 
contractor  was  properly  carrying  out  its  subcontractor  oversight 


17  See  list  of  related  products  at  the  end  of  this  testimony. 

18  GAO,  Hanford  Waste  Treatment  Plant:  Department  of  Energy  Needs  to  Strengthen 
Controls  over  Contractor  Payments  and  Project  Assets,  GAO-07-888  (Washington,  D.C.: 
July  20,  2007). 
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responsibility.  DOE’s  heavy  reliance  on  DCAA  and  the  contractor,  with 
little  oversight  of  its  own,  exposed  the  hundreds  of  millions  of  dollars  it 
spent  annually  on  the  WTP  project  to  an  unnecessarily  high  risk  of 
improper  payments.  Our  July  2007  report  made  11  recommendations  to 
improve  DOE’s  oversight  of  and  accountability  for  WTP  expenditures. 

DOE  officials  advised  us  that  they  have  completed  action  on  all  11 
recommendations.  We  are  currently  following  up  to  confirm  DOE’s 
actions. 

Centers  for  Medicare  and  Medicaid  Services  (CMS).  We  evaluated 
CMS’s  Medicare  Modernization  Act  (MMA)  program  contracting  activity 
and  found  that  CMS  did  not  fulfill  critical  contractor  oversight 
responsibilities,  such  as  reviewing  contractors’  indirect  cost  rate 
information  and  assessing  the  adequacy  of  the  contractors’  accounting 
systems,  thereby  increasing  risks  of  fraud,  waste,  and  abuse  not  only  to 
CMS  but  to  other  federal  agencies  that  may  use  the  same  contractors. 19 
Specifically,  we  identified  numerous  questionable  payments  totaling 
nearly  $90  million  that  represented  potentially  improper,  unsubstantiated, 
or  wasteful  payments.  For  example,  we  found  payments  for  costs  that  did 
not  comply  with  the  terms  of  the  contract  or  applicable  regulation,  such  as 
costs  for  unapproved  labor  categories,  costs  exceeding  contract  indirect 
rate  ceiling  amounts,  and  travel  costs  in  excess  of  allowable  limits.  In 
other  cases,  we  were  unable  to  obtain  adequate  documentation,  such  as 
vendor  invoices  or  time  sheets,  to  support  costs  billed.  In  addition,  we 
identified  payments  for  which  risks  in  CMS’s  contracting  practices 
resulted  in  potential  waste.  In  some  cases,  due  to  the  facts  and 
circumstances  involved,  we  were  unable  to  determine  whether  or  to  what 
extent  the  costs  were  allowable,  reasonable,  and  allocable.  Our  November 
2007  report  made  nine  recommendations  to  the  Administrator  of  CMS  to 
improve  internal  control  and  accountability  in  the  contracting  process  and 
related  payments  to  contractors.  CMS  completed  actions  to  develop 
agency-specific  policies  and  procedures  for  the  review  of  contractor 
invoices  and  create  a  centralized  tracking  mechanism  that  records  the 
training  taken  by  personnel  assigned  to  contract  oversight  activities.  In 
addition,  CMS  officials  advised  that  CMS  has  recovered  $2.8  million, 
deemed  $7.5  million  in  questioned  payments  to  be  proper,  and  anticipate 
the  remaining  questioned  cost  will  be  found  to  have  been  proper  after 


19  GAO,  Centers  for  Medicare  and  Medicaid  Services:  Internal  Control  Deficiencies 
Resulted  in  Millions  of  Dollars  of  Questionable  Contract  Payments,  GAO-08-54 
(Washington,  D.C.:  Nov.  15,  2007). 
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indirect  rate  audits  are  complete.  We  are  continuing  to  follow  up  on  CMS’s 
progress  in  addressing  the  remaining  seven  open  recommendations. 

As  a  result  of  the  contracting  weaknesses  we  found  in  the  MMA  program, 
GAO  was  asked  to  evaluate  CMS’s  internal  controls  over  its  contracting 
activities. 20  Based  on  our  audit,  we  found  pervasive  deficiencies  in  CMS’s 
internal  controls  over  contracting  and  payments  to  contractors.  The 
internal  control  deficiencies  occurred  throughout  the  contracting  process 
phases.  These  deficiencies  were  due  in  part  to  a  lack  of  agency-specific 
policies  and  procedures  to  ensure  that  FAR  requirements  and  other 
control  objectives  were  met.  CMS  also  did  not  take  appropriate  steps  to 
ensure  that  existing  policies  were  properly  implemented  nor  maintained 
adequate  documentation  in  its  contract  files.  As  a  result  of  our  work,  we 
estimated  that  at  least  84.3  percent  of  FAR-based  contract  actions  made  by 
CMS  in  fiscal  year  2008  contained  at  least  one  instance  in  which  a  key 
control21  was  not  adequately  implemented.  We  also  estimated  that  at  least 
37.2  percent  of  FAR-based  contract  actions  made  in  fiscal  year  2008  had 
three  or  more  instances  in  which  a  key  control  was  not  adequately 
implemented.  The  high  percentage  of  deficiencies  indicated  a  serious 
failure  of  control  procedures  over  FAR-based  acquisitions,  thereby 
creating  a  heightened  risk  of  making  improper  payments  or  waste.  Our 
October  2009  report  made  nine  additional  recommendations  to  the  CMS 
Administrator  to  develop  and  implement  policies  and  procedures  to 
ensure  that  FAR  requirements  and  other  control  objectives  are  met.  We 
have  obtained  documentation  on  CMS’s  actions  and  are  in  the  process  of 
validating  this  information.  CMS  officials  told  us  they  expect  to  complete 
actions  on  all  but  one  of  our  recommendations  by  March  31,  2011. 


Ineffective  Contract 
Auditing 


In  2009,  we  reported  on  audit  quality  problems  at  DCAA  offices 
nationwide,  including  compromise  of  auditor  independence,  insufficient 
audit  testing,  and  inadequate  planning  and  supervision.  In  addition, 
DCAA’s  management  environment  and  quality  assurance  structure  were 
based  on  a  production-oriented  mission  that  put  DCAA  in  the  role  of 


GAO,  Centers  for  Medicare  and  Medicaid  Services:  Deficiencies  in  Contract  Management 
Internal  Control  Are  Pervasive,  GAO-10-60  (Washington,  D.C.:  Oct.  23,  2009). 

-1  We  determined  a  control  to  be  “key”  based  on  our  review  of  the  standards  for  internal 
control  as  well  as  the  FAR,  Health  and  Human  Services  Acquisition  Regulations,  and 
agency  policies  and  whether  inadequate  implementation  would  significantly  increase  the 
risk  of  improper  payments  or  waste. 
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facilitating  DOD  contracting  without  also  protecting  the  public  interest. 22 
We  found  serious  quality  problems  in  the  69  audits  and  cost-related 
assignments  we  reviewed.23  For  example,  65  of  these  assignments 
exhibited  serious  noncompliance  with  generally  accepted  government 
auditing  standards  (GAGAS)  or  other  deficiencies  similar  to  those  found  in 
our  investigation,24  including  compromise  of  auditor  independence, 
insufficient  audit  testing,  and  inadequate  planning  and  supervision.  DCAA 
has  taken  action  on  many  of  our  recommendations  but  continues  to 
experience  significant  audit  quality  problems  across  offices  in  all  DCAA 
regions. 

As  a  result  of  our  work,  DCAA  rescinded  over  80  audit  reports  because  its 
underlying  audit  evidence  was  outdated,  insufficient,  or  inconsistent  with 
reported  conclusions  and  opinions.  Those  rescinded  audits  had  been 
issued  to  support  decisions  on  contract  pricing  and  awards  and  impacted 
the  planning  and  reliability  of  hundreds  of  other  DCAA  audits, 
representing  billions  of  dollars  in  DOD  expenditures.  About  one-third  of 
the  rescinded  reports  relate  to  unsupported  opinions  on  contractor 
internal  controls  and  were  used  as  the  basis  for  risk  assessments  and 
planning  on  subsequent  internal  control  and  cost-related  audits.  Other 
rescinded  reports  relate  to  Cost  Accounting  Standards  (CAS)  compliance 
and  contract  pricing  decisions.  Because  the  conclusions  and  opinions  in 
the  rescinded  reports  were  used  to  assess  risk  in  planning  subsequent 
audits,  they  impact  the  reliability  of  hundreds  of  other  audits  and 
contracting  decisions  covering  billions  of  dollars  in  DOD  expenditures. 

A  management  environment  and  agency  culture  that  focused  on 
facilitating  the  award  of  contracts  and  an  ineffective  audit  quality 
assurance  structure  are  at  the  root  of  DCAA’s  agencywide  audit  failures 
we  identified.  DCAA’s  focus  on  a  production-oriented  mission  led  DCAA 
management  to  establish  policies,  procedures,  and  training  that 
emphasized  performing  a  large  quantity  of  audits  to  support  contracting 
decisions  and  gave  inadequate  attention  to  performing  quality  audits.  An 
ineffective  quality  assurance  structure,  whereby  DCAA  gave  passing 
scores  to  deficient  audits,  compounded  this  problem. 


22  GAO,  DCAA  Audits:  Widespread  Problems  with  Audit  Quality  Require  Significant 
Reform,  GAO-09-468  (Washington,  D.C.:  Sept.  23,  2009). 

23  Of  the  69  DCAA  assignments  we  reviewed,  37  were  audits  of  contractor  systems  and 
related  internal  controls  and  32  were  cost-related  audits  and  assignments. 

24  GAO-08-857. 
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Lack  of  independence.  In  seven  audits,  independence  was  compromised 
because  auditors  provided  material  nonaudit  services  to  a  contractor  they 
later  audited;  experienced  access  to  records  problems  that  were  not  fully 
resolved;  and  significantly  delayed  report  issuance,  which  allowed  the 
contractors  to  resolve  cited  deficiencies  so  that  they  were  not  cited  in  the 
audit  reports. 

Unsupported  opinions.  Thirty-three  of  37  internal  control  audits  did  not 
include  sufficient  testing  of  internal  controls  to  support  auditor 
conclusions  and  opinions,  which  are  relied  on  for  2  to  4  years,  and 
sometimes  longer.  The  lack  of  sufficient  support  for  those  audit  opinions 
rendered  them  unreliable  for  decision  making  on  contract  awards,  direct- 
billing  privileges,  the  reliability  of  cost  estimates,  and  reported  direct  cost 
and  indirect  cost  rates.  For  example,  we  found  that: 

•  For  many  controls,  DCAA  did  not  perform  any  testing  at  all.  For 
example,  audits  of  contractor  accounting  systems  focus  on  a  review  of 
the  adequacy  of  contractor  policies  and  procedures.  At  least  six  of  the 
nine  accounting  audits  we  reviewed  did  not  include  procedures  for 
confirming  contractor  segregation  of  allowable  and  unallowable  cost. 

•  DCAA  issued  an  “adequate”  opinion  on  the  accounting  system  for  a 
major  DOD  contractor,  indicating  that  system  controls  were  effective, 
after  performing  only  a  walkthrough  of  the  accounting  process  and 
interviewing  two  employees. 

•  In  billing  system  audits  we  reviewed,  DCAA  auditors  often  tested  only 
two,  three,  or  sometimes  five  transactions  to  support  audit  conclusions 
on  contractor  systems  and  related  internal  controls.  Twenty  of  the  22 
billing  system  audits  we  reviewed  did  not  include  tests  to  identify 
duplicate  invoices. 

•  In  one  audit,  DCAA  auditors  reported  on  the  adequacy  of  a 
contractor’s  billing  system  based  on  tests  of  only  four  vouchers — all 
issued  on  the  same  day. 

•  In  an  audit  of  controls  over  indirect  and  other  direct  cost  for  a 
business  segment  of  one  of  the  top  five  DOD  contractors,  DCAA 
auditors  tested  only  12  out  of  about  22,000  transactions  processed 
from  May  through  July  2005. 

Similarly,  the  32  cost-related  assignments  we  reviewed  did  not  contain 
sufficient  testing  to  provide  reasonable  assurance  that  overpayments  and 
billing  errors  that  might  have  occurred  were  identified.  As  a  result,  there  is 
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little  assurance  that  any  such  errors,  if  they  occurred,  were  corrected  and 
that  related  improper  contract  payments,  if  any,  were  refunded  or  credited 
to  the  government.  Contractors  are  responsible  for  ensuring  that  their 
billings  reflect  fair  and  reasonable  prices  and  contain  only  allowable  costs, 
and  taxpayers  expect  DCAA  to  review  these  billings  to  provide  reasonable 
assurance  that  the  government  is  not  paying  more  than  it  should  for  goods 
and  services.  We  identified  the  following  problems  with  these 
assignments. 

•  Paid  voucher  reviews.  Under  the  direct-bill  program,  contractors 
may  submit  their  invoices  directly  to  the  DOD  disbursing  officer  for 
payment  without  further  review.  DCAA  performs  annual  testing  of  paid 
vouchers  (invoices)  to  determine  if  contractor  voucher  preparation 
procedures  are  adequate  for  continued  contractor  participation  in  the 
direct-bill  program.25  For  the  16  paid  voucher  assignments  we 
reviewed,  we  found  that  DCAA  auditors  failed  to  comply  with  DCAA 
Contract  Audit  Manual  (CAM)  guidance.26  Auditors  generally  did  not 
identify  the  population  of  vouchers,  did  not  create  sampling  plans,  and 
made  a  small,  nonrepresentative  selection  of  as  few  as  one  or  two 
invoices  for  testing  to  support  conclusions  on  their  work.  Based  on  the 
limited  work  that  was  performed,  the  auditors  concluded  that  controls 
over  invoice  preparation  were  sufficient  to  support  approval  of  the 
contractors’  direct  billing  privileges.  This  is  of  particular  concern 
because  we  determined  that  Defense  Finance  and  Accounting  Service 
(DFAS)  certifying  officers  rely  on  DCAA  voucher  reviews. 

•  Overpayment  assignments.  DCAA  performs  overpayment 
assignments  to  verify  that  contractors  have  billing  procedures  and 
internal  controls  in  place  to  identify  and  resolve  contractor  billing 
errors  and  overpayments  in  a  timely  manner.  We  found  that  auditor 
judgments  about  the  population  and  selection  of  transactions  for  these 
assignments  did  not  provide  a  representative  universe  for  testing  and 
concluding  on  contractor  controls  over  billings  and  payments 
received.  As  a  result,  this  work  does  not  provide  reasonable  assurance 
that  contractors  have  adequate  controls  in  place  to  identify  and  correct 
overpayments  and  billing  errors  and  make  appropriate,  timely  refunds 
and  adjustments. 


25  DCAA  does  not  perfonn  paid  voucher  reviews  during  the  year  that  it  performs  an  audit  of 
the  contractor’s  billing  system  internal  controls. 

26  CAM  6-1007. 
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•  Incurred  cost  audits.  The  purpose  of  incurred  cost  audits  is  to 
examine  contractors’  cost  representations  and  opine  on  whether  the 
costs  are  allowable,  allocable  to  government  contracts,  and  reasonable 
in  accordance  with  the  contract  and  applicable  government  acquisition 
regulations.27  For  the  four  incurred  cost  audits  we  reviewed,  we  found 
that  the  auditors  did  not  perform  sufficient,  detailed  testing  of  claimed 
indirect  and  direct  costs.  As  a  result,  the  scope  of  work  performed  was 
not  sufficient  to  identify  claimed  costs,  if  any,  that  were  not  adequately 
supported  or  unallowable  costs,  if  any,  that  should  have  been 
questioned. 

DCAA’s  mission  statement,  strategic  plan,  and  metrics  all  focused  on 
producing  a  large  number  of  audit  reports  and  provided  little  focus  on 
assuring  quality  audits.  For  example,  in  fiscal  year  2008,  DCAA  performed 
approximately  30,000  audits  with  3,600  auditors.  This  workload 
substantially  contributed  to  the  widespread  audit  quality  problems  we 
identified.  While  DCAA  has  increased  its  staff  to  about  4,700,  of  which 
about  86  percent  are  auditors,  and  reduced  the  number  of  reports  issued  in 
fiscal  year  2010  to  about  10,000.  Based  on  routine  audit  follow-up  work, 
we  have  determined  that  DCAA  has  allocated  resources  to  the  highest  risk 
contracts  but  not  yet  fully  completed  actions  on  a  risk-based  audit 
approach,  with  consideration  of  resources  and  auditing  standards,  that  is 
effective  in  protecting  taxpayer  interest.  In  addition,  DCAA  has  not  yet 
resolved  fundamental  weaknesses  in  its  strategic  plan,  metrics,  and  human 
capital  practices  that  had  a  detrimental  effect  on  audit  quality.  In  addition, 
DCAA  and  the  Defense  Contract  Management  Agency  (DCMA)  identified 
as  part  of  their  current  cost  recovery  initiative  that  there  is  a  significant 
backlog  of  Cost  Accounting  Standards  (CAS)  cost  impact  issues  requiring 
disposition  and  resolution  by  administrative  contracting  officers. 
According  to  DOD  Inspector  General  officials,  these  CAS  issues  represent 
billions  of  dollars  of  unresolved  audit  findings  and  the  6-year  statute  of 
limitations  is  running  out  on  many  of  them. 

Considering  the  large  number  of  DCAA  audit  reports  issued  annually  and 
the  reliance  the  contracting  and  finance  communities  place  on  DCAA  audit 
conclusions  and  opinions,  effective  and  reliable  contract  audits  are 
necessary  to  protecting  the  public  interest. 


27  CAM  6-102. 
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In  our  2009  report,  we  made  17  specific  recommendations  to  DOD  and  the 
DOD  Inspector  General  (IG)  to  improve  DCAA’s  management 
environment,  audit  quality,  and  oversight.  DOD  and  DCAA  have  taken  a 
number  of  actions  on  our  recommendations,  including  revising  DCAA’s 
mission  statement,  appointing  a  new  DCAA  Director  and  a  Western  Region 
Director,  establishing  an  internal  review  office  to  perform  periodic 
internal  evaluations  and  address  hotline  complaints,  initiating  outside 
hiring,  expanding  its  audit  quality  review  function,  and  providing  training 
on  auditing  standards.  While  DCAA  has  initiated  actions  on  our  other 
recommendations,  as  discussed  in  our  report,  DCAA  will  need  more  time 
to  complete  those  actions.  Those  include  achieving  changes  in  its 
management  environment  and  culture,  developing  a  strategic  plan  that 
links  to  performance  metrics  and  a  human  capital  strategic  plan, 
developing  a  well-supported  risk-based  contract  audit  approach,  obtaining 
outside  expertise  on  auditing  standards  to  assist  in  revising  its  contract 
auditing  policies  and  procedures,  and  providing  guidance  on  sampling  and 
testing  for  the  various  types  of  audits  it  performs.  DOD  IG  has  expanded 
its  oversight  of  DCAA’s  audit  quality  control  process. 

Our  2009  report  also  offered  some  potential  actions  for  strengthening  the 
organizational  effectiveness  of  DCAA  and  the  contract  audit  function  in 
the  federal  government.  These  potential  actions  would  require  further 
study  as  well  as  congressional  action,  and  include  actions  intended  to 
(1)  increase  DCAA’s  authority  and  independence,  (2)  provide  for 
additional  reporting  and  oversight  of  audit  results,  and  (3)  evaluate 
whether  certain  organizational  changes  to  DCAA  could  strengthen  its 
independence  and  improve  audit  quality.  We  have  reprinted  the  detail  of 
these  options  in  appendix  II. 


Madam  Chairman  and  Members  of  the  Subcommittee,  this  concludes  my 
statement.  We  would  be  pleased  to  answer  any  questions  that  you  may 
have  at  this  time. 
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Appendix  I:  DCAA  Audit  and  Nonaudit 
Services 


Table  1  lists  several  audit  and  nonaudit  services  performed  by  the  Defense 
Contract  Audit  Agency  (DCAA)  during  the  three  phases  of  the  contracting 
process — preaward  and  award,  contract  administration  and  management, 
and  closeout — and  cites  the  statutory  and  regulatory  provisions  that 
authorize  or  establish  the  need  to  have  DCAA  perform  the  service.  DCAA 
audits  also  support  the  contract  payment  process  both  directly  and 
indirectly.  For  example,  audits  of  contractor-incurred  cost  claims  and 
voucher  reviews  directly  support  the  contract  payment  process  by 
providing  the  information  necessary  to  certify  payment  of  claimed  costs.  1 
Other  audits  of  contractor  systems,  including  audits  of  contractor  internal 
controls,  CAS  compliance,  and  defective  pricing,  indirectly  support  the 
payment  process  by  providing  assurance  about  contractor  controls  over 
cost  accounting,  cost  estimating,  purchases,  and  billings  that  the  agency 
may  rely  upon  when  making  contract  decisions,  such  as  determinations  of 
reasonable  and  fair  prices  on  negotiated  contracts.  For  example,  an 
accounting  system  deemed  to  be  adequate  by  a  DCAA  audit  permits 
progress  payments  based  on  costs  to  be  made  without  further  audit.2 


1  Disbursing  officers  are  authorized  to  make  payments  on  the  authority  of  a  voucher 
certified  by  an  authorized  certifying  officer,  who  is  responsible  for  the  legality,  accuracy, 
and  propriety  of  the  payment.  31  U.S.C.  §§  3325,  3521(a),  and  3528(a). 

2  FAR  §  32.503-4. 
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Table  1 :  Examples  of  DCAA  Audit  and  Nonaudit  Services. 

Contract  phase  and 

Contracting 

Payment  support 

assignment 

Audit  and  nonaudit  services 

support 

Direct 

Indirect 

Preaward  and  award  phase: 

Accounting  system3 

Audit:  DCAA  determines  adequacy  of  the  contractor’s  accounting 
system  prior  to  award  of  a  cost-reimbursable  or  other  flexibly  priced 
contract.  FAR  §  1 6.301  -3(a)(1 ). 

X 

X 

Contractor  accounting 
disclosure  statements 

Audit:  DCAA  reviews  the  contractor’s  Disclosure  Statement  for 
adequacy  and  CAS  compliance  and  determines  whether  the 
contractor’s  Disclosure  Statement  is  current,  accurate,  and  complete. 
DCAA  also  reviews  Disclosure  Statements  during  the  postaward 
phase  if  contractors  revise  them.  FAR  §§  30.202-6(c),  30.202-7  and 
30.601(c). 

X 

X 

Estimating  system3 

Audit:  DCAA  determines  adequacy  of  contractor  estimating  systems. 
FAR  §  1 5.407-5  and  DFARS  §  252.21 5-7002(d),  (e). 

X 

X 

Contract  price 
proposals  and  forward 
pricing  proposalsb 

Audit:  DCAA  examines  contractor  records  to  ensure  that  cost  or 
pricing  data  are  accurate,  current,  and  complete  and  supports  the 
determination  of  fair  and  reasonable  prices.  1 0  U.S.C.  §§  2306a  and 
2313  (DOD)  and  41  U.S.C.  §  254d  (other  agencies);  FAR  Subpart 

15.4  (esp.  FAR  §  15.404-2(c))  and  §  52.21 5-2(c);  and  DFARS  § 
215.404-1. 

X 

X 

Financial  liaison 
advisory  services11 

Nonaudit:  DCAA  Director  establishes  and  maintains  liaison  auditors 
and  financial  advisors,  as  appropriate,  at  major  procuring  and  contract 
administration  offices.  These  services  are  also  provided  during  the 
postaward  phase,  as  needed.  DODD  5105.36,  paras.  7.1.1  and  5.9. 

X 

X 

Postaward/administration  and  management  phase: 

Internal  control  system 
audits  (generally) 

Audit:  DCAA  reviews  the  financial  and  accounting  aspects  of  the 
contractor’s  cost  control  systems,  including  the  contractor's  internal 
control  systems.  FAR  §  42.1 01  (a)(3)  and  DFARS  §  242.7501 . 

X 

X 

Billing  system  audits3 

Audit:  DCAA  determines  adequacy  of  contractors'  billing  system 
controls  and  reviews  accuracy  of  paid  vouchers.  DCAA  uses  audit 
results  to  support  approval  of  contractors  to  participate  in  the  direct-bill 
program.  FAR  §  42.101  and  DFARS  §  42.803  (b)(i)(C). 

X 

X 

Purchasing  system 
review6 

Audit:  DCAA  determines  adequacy  of  a  contractor’s  or 
subcontractor's  purchasing  system.  FAR  Subpart  44.3. 

X 

X 

Progress  payments6 

Audit:  DCAA  verifies  amount  claimed,  determines  allowability  of 
contractor  requests  for  cost-based  progress  payments,  and 
determines  if  the  payment  will  result  in  undue  financial  risk  to  the 
government.  FAR  §§  32.503-3,  32.503-4,  and  52.232-16. 

X 

X 

Incurred  cost  claims3 

Audit:  DCAA  determines  acceptability  of  the  contractors’  claimed 
costs  incurred  and  submitted  by  contractors  for  reimbursement  under 
cost-reimbursable,  fixed-price  incentive,  and  other  types  of  flexibly 
priced  contracts  and  compliance  with  contract  terms,  FAR,  and  CAS, 
if  applicable.  FAR  §§  42.1 01 , 42.803(b),  and  DFARS  §  242.803. 

X 

X 

Billing  rates  and  final 
indirect  cost  rates3 

Audit:  DCAA  establishes  billing  rates  for  interim  indirect  costs  and 
final  indirect  cost  rates.  FAR  §§  42.704,  42.705  and  42.705-2  and 
DFARS  §  42.705-2. 

X 

X 
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Contract  phase  and 

Contracting 

Payment  support 

assignment 

Audit  and  nonaudit  services 

support 

Direct 

Indirect 

Defective  pricing6 

Audit:  DCAA  determines  the  amount  of  cost  adjustments  related  to 
defective  pricing.  See  above  authorities  to  audit  contractor  cost  and 
pricing  data  and  FAR  §  1 5.407-1 . 

X 

X 

CAS  compliance6 

Audit:  DCAA  determines  contractor  and  subcontractor  compliance 
with  CAS  set  forth  in  48  CFR  §  9903.201  and  determines  cost  impacts 
of  noncompliance.  FAR  §§  1.602-2,  30.202-7,  and  30.601(C). 

X 

X 

Other  specially 
requested  services 

Audit  and  nonaudit  services:  DCAA  conducts  performance  audits 
and  other  audits  based  on  requests  from  DOD  components  and 
requests  from  other  federal  agencies.  DOD  Directive  5105.36,  Sec.  5. 

X 

X 

Paid  voucher  reviews3 

Nonaudit  services:  DCAA  reviews  vouchers  after  payment  to  support 
continued  contractor  participation  in  the  direct  bill  program.  CAM  6- 
1007.6;  FAR  §  42.803;  DFARS  §  242.803;  DODD  5105.36,  paras.  5.4 
and  5.5;  and  DOD  Financial  Management  Regulation  (FMR),  vol.  10, 
ch.  10,  para.  100202. 

X 

X 

Approval  of  vouchers 
prior  to  payment3 

Nonaudit:  DCAA  reviews  and  approves  contractor  interim  vouchers 
for  payment  and  suspends  payment  of  questionable  costs.  FAR  § 
42.803;  DFARS  §  242.803(b)(i)(B);  DOD  Directive  5105.36,  paras.  5.4 
and  5.5;  and  DOD  FMR  vol.  10,  ch.  10,  para.  100202. 

X 

X 

Overpayment  reviews3 

Nonaudit  services:  At  the  request  of  the  contracting  officer,  DCAA 
reviews  contractor  data  to  identify  potential  contract  overpayments. 

FAR  §§  2.605,  52.21 6-7(g),  (h)2. 

X 

X 

Closeout  phase: 

Contract  closeout 
procedures  and  audits3 

Audit:  DCAA  reviews  final  completion  vouchers  and  the  cumulative 
allowable  cost  worksheet  and  may  review  contract  closing  statements. 
DFARS  §  242.803(b)(i)(D). 

X 

X 

Source:  GAO  analysis. 


“Indicates  DCAA  audit  and  nonaudit  services  covered  in  this  audit. 

“Indicates  types  of  audits  covered  in  our  prior  investigation  (GAO-08-857).  We  reviewed  progress 
payment  and  contract  closeout  audits  that  related  to  audits  in  our  earlier  investigation  or  this  audit 
where  the  auditors  considered  the  evidence  in  those  audits. 
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Appendix  II:  Potential  Legislative  and  Other 
Actions  for  Strengthening  DCAA  and  the 
Contract  Audit  Function 


In  our  September  2009  report,1  we  identified  certain  legislative  and  other 
actions,  such  as  authorities  and  protections  similar  to  those  granted  to 
federal  agency  Inspectors  general  (IG)  in  the  IG  Act,  and  changes  in 
organizational  placement,  that  could  enhance  Defense  Contract  Audit 
Agency  (DCAA)  effectiveness  and  independence.2  Successful  management 
initiatives  for  cultural  and  organizational  change  in  large  private  and 
public  sector  organizations  can  often  take  several  years  to  accomplish.  We 
caution  that  changing  DCAA’s  organizational  placement  without  first 
correcting  fundamental  weaknesses  in  mission  and  the  overall 
management  environment  would  not  assure  effective  audits. 


Short-term  Legislative  In  addition  to  DCAA  management  reforms  already  under  way  and  our 

Actions  additional  recommendations,  our  2009  report  identified  certain  legislative 

protections  and  authorities  under  the  IG  Act  that  could  enhance  DCAA’s 
effectiveness.  Legislation  would  be  needed  in  order  to  grant  DCAA  such 
protections  and  authorities. 

Leadership.  The  IG  Act  provides  for  the  President  to  appoint  the  IG,  with 
Senate  confirmation,  at  many  federal  agencies.3  Under  the  act,  Congress 
must  be  notified  in  advance  of  removing  the  IG,  and  only  Congress  can 
eliminate  the  office  of  an  IG.  Currently,  the  head  of  DCAA  is  appointed  and 
can  be  removed  by  the  Secretary  of  Defense.  Further,  DCAA  was  created 
and  can  be  reorganized  or  reassigned  by  departmental  order  without 
notice.  IG  Act  protections  Congress  could  grant  to  DCAA  would  therefore 
include  (1)  Senate  confirmation  of  a  presidentially  appointed  DCAA 
Director4  and  (2)  removal  of  the  DCAA  Director  conditioned  on 
congressional  notification.  5  Specifically,  the  act  provides  that  an  IG  may 
be  removed  from  office  by  the  President  and  any  removal  is  to  be  reported 
to  both  Houses  of  Congress  30  days  prior  to  the  removal.  In  addition  to 
these  IG  Act  protections,  Congress  could  build  additional  provisions  into 
legislation,  to  include  the  following: 


1  GAO-09-468. 

2  Codified  in  an  appendix  to  Title  5  of  the  United  States  Code  (hereafter  5  U.S.C.  App.) 

3  The  IG  Act  also  requires  the  heads  of  many  “designated  federal  entities”  to  appoint  an 
inspector  general  for  each  entity.  5  U.S.C.  §  App.  8G. 

4  5  U.S.C.  App.  §  3(a). 

5  5  U.S.C.  App.  §  3(b). 
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•  Requirements  that  the  DCAA  Director  possess  the  appropriate 
professional  qualifications.  For  example,  provisions  for  appointment  of 
the  DCAA  Director  could  require  selection  from  among  individuals 
who  possess  demonstrated  ability  in  managing  and  leading 
organizations,  specific  accounting  or  auditing  background,  general 
knowledge  of  contract  management,  and  knowledge  of  and  extensive 
practical  experience  in  financial  management  practices  in  large 
governmental  or  business  entities. 

•  A  mandate  permitting  the  DCAA  Director  to  hold  a  renewable  term 
appointment  of  between  5  to  7  years.  Legislation  should  provide  that 
the  DCAA  Director  can  be  removed  only  for  cause  or  other  stated 
reasons.  These  protections  would  allow  the  head  of  DCAA  to  provide 
stability  and  continuity  of  leadership  that  span  presidential 
administrations  and  prevent  removal  except  for  cause  or  other 
disclosed  reasons. 

•  Conflict  of  interest  provisions  for  the  DCAA  Director  and  other  key 
staff  in  addition  to  those  provisions  currently  in  law.  This  would  be 
intended  to  ensure  that  selection  of  the  audit  agency  head  would  not 
involve  a  “revolving  door”  situation  between  contractors  and  the 
contract  audit  agency. 

Access  to  independent  legal  counsel.  The  IG  Act  provides  for 
independent  legal  advice  for  IGs  rather  than  requiring  the  use  of  agency 
legal  counsel.6  Currently,  DCAA  relies  upon  DOD  legal  counsel.7  DCAA 
officials  told  us  that  the  DCAA  Director  has  not  always  been  apprised  of 
legal  decisions  by  DOD  counsel  that  have  impacted  DCAA  operations. 
Further,  according  to  the  DCAA  Director,  the  lack  of  independent  counsel 
led  to  a  situation  where  DOD  attorneys  provided  questionable  legal 
counsel  to  a  DCAA  field  office  supervisor  without  the  DCAA  Director’s 
knowledge.  Obtaining  independent  legal  counsel  would  avoid  conflicts  of 
interest  between  DOD  and  DCAA,  thereby  helping  to  improve  DCAA’s 
effectiveness. 

Budget.  The  IG  Act  requires  separate  budgets  for  Offices  of  Inspector 
General  (OIG)  within  agency  budgets,  allowing  Congress  to  review  IG 


6  5  U.S.C.  App.  §  8F(4)(A). 

7  Section  893(g)  of  the  Ike  Skelton  National  Defense  Authorization  Act  for  Fiscal  Year  2011 
requires  the  Secretary  of  Defense  to  ensure  that  DCAA  has  sufficient  legal  resources  and 
expertise  to  conduct  its  work  in  a  manner  that  is  consistent  with  audit  independence. 
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budget  requests  separately.  DCAA  currently  does  not  have  this  protection. 
IGs  that  are  appointed  by  the  President  with  Senate  confirmation  receive  a 
separate  appropriation,  preventing  agencies  from  reprogramming  IG  funds 
to  other  programs  and  activities.  However,  there  is  currently  little  visibility 
over  DCAA’s  budget  because  it  is  funded  under  the  Operations  and 
Maintenance,  Defense-wide  appropriation,  which  includes  numerous  DOD 
agencies,  such  as  the  Defense  Contract  Management  Agency  (DCMA),  the 
Defense  Logistics  Agency,  the  Defense  Finance  and  Accounting  Service, 
and  some  buying  command  activities.  Therefore,  DCAA’s  share  of  annual 
appropriations  is  subject  to  reprogramming,  sometimes  without 
congressional  notification.  According  to  the  DCAA  Director  and 
documentation  provided  by  the  Director  and  Office  of  Comptroller/CFO, 
in  the  past,  DOD  has  reprogrammed  funding  between  DCAA  and  other 
DOD  activities  on  numerous  occasions.  Because  these  reprogrammings 
were  below  the  $15  million  threshold  for  congressional  notification, 
Congress  did  not  have  notice  of  these  funding  decreases  at  the  time  they 
occurred.  For  fiscal  year  2009,  DOD  reprogramming  increased  DCAA’s 
funding  by  $3.5  million.  Legislation  similar  to  the  IG  Act  could  grant  DCAA 
a  separate  budget8  to  provide  visibility  and  protections  from 
reprogramming  of  funds  to  other  agency  priorities. 

Increased  authority  and  independence.  Legislation  could  strengthen 
DCAA’s  audit  authority  by  providing  the  same  level  of  access  to  records 
and  personnel  available  to  IGs.9  Currently,  DCAA  has  statutory  access  to 
certain  records  related  to  cost-type  contracts  or  those  that  contain  cost 
and  pricing  data,  but  not  to  contractor  personnel.  As  a  result,  DCAA’s 
subpoena  power  is  limited  to  certain  records  and  does  not  cover 
contractor  personnel.  While  we  recognize  that  DCAA  auditors  have 
ongoing  discussions  with  contractor  personnel,  they  do  not  have  statutory 
authority  to  compel  contractor  officials  to  meet  with  them  and  submit  to 
interviews.  IGs  have  authority,  including  subpoena  power,  to  access  all 
records,  reports,  audits,  reviews,  documents,  papers,  recommendations,  or 
other  material  available  that  relate  to  programs  and  operations  for  which 
the  IG  has  responsibilities.  Further,  IG  subpoena  authority  extends  beyond 
access  to  records  and  documents  in  that  IG  auditors  can  administer  or 
take  an  oath  in  order  to  obtain  information.  Our  discussions  with  DCAA 
auditors  and  reviews  of  audit  documentation  identified  numerous 


8  5  U.S.C.  App.  §  6(f)(1). 

9  6  U.S.C.  App.  §  6(a)(1),  (4),  and  (5). 
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instances  where  requests  for  contractor  records  were  not  met. 10  Obtaining 
increased  access  to  contracting  companies,  especially  their  staff  and 
documentation,  would  be  an  important  provision  to  improve  the 
effectiveness  of  DCAA  audit  staff. 

Reporting  and  oversight  of  audit  results.  The  IG  Act  provides  for 
semiannual  reports  to  the  agency  head  and  appropriate  committees  of 
Congress  summarizing  results  of  significant  audits  and  investigations. 11 
DCAA  currently  has  no  external  reporting  requirement,  reducing 
opportunities  for  oversight  and  transparency.  Congress  could  mandate 
some  form  of  external  DCAA  reporting  in  legislation  similar  to  the  IG  Act. 
Moreover,  DCAA  does  not  currently  provide  copies  of  its  audit  reports  to 
other  federal  agencies  that  use  the  same  contractors  that  DOD  uses. 
According  to  the  DCAA  Director,  DCAA’s  appropriations  are  specific  to 
DOD  contractor  audits,  and  unless  federal  agencies  request  and  reimburse 
DCAA  for  audit  services,  DCAA  cannot  provide  them  with  copies  of  its 
audit  reports  even  though  these  reports  may  cover  their  contractors. 
Legislation  could  also  expressly  allow  DCAA  to  provide  audit  results  to 
other  agencies,  a  step  that  would  improve  its  visibility  and  effectiveness 
for  the  government  as  a  whole. 

Legislation  to  grant  DCAA  similar  protections  and  authorities  as  those 
provided  in  the  IG  Act  could  enhance  reform  efforts  that  are  already  under 
way.  Although  we  found  that  a  lack  of  DOD  Comptroller/CFO  and  IG 
oversight  has  impaired  DCAA’s  effectiveness,  DOD  has  begun  work  to 
provide  improved  oversight  of  DCAA’s  operations.  In  August  2008,  the 
DOD  Comptroller/CFO  conducted  a  “tiger  team”  review  of  DCAA’s  audit 
quality  assurance  program,  and  DOD  approved  a  more  comprehensive 
Defense  Business  Board  (DBB)  study.  The  new  DOD  Comptroller/CFO 
recognized  the  need  for  DCAA  oversight  and  on  March  16,  2009,  approved 
the  charter  for  a  DCAA  Oversight  Committee.  Committee  members  include 
the  Auditors  General  of  the  Army,  the  Navy,  and  the  Air  Force;  the  DOD 
Director  of  Defense  Procurement  and  Acquisition  Policy;  and  the  DOD 
Deputy  General  Counsel  for  Acquisition  and  Technology.  The  committee 
held  its  first  meeting  in  early  April  2009.  During  May  2009,  the  DCAA 
Oversight  Committee  members  reviewed  selected  DCAA  audits  and  visited 


10  As  noted  previously,  in  these  cases,  there  was  no  evidence  that  DCAA  supervisors 
elevated  the  issue  to  management  or  to  procurement  officials  to  initiate  enforcement 
action,  as  set  out  in  DCAA  policy. 

11  5  U.S.C.  App.  §  5(a). 
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a  DCAA  field  office.  The  committee  is  continuing  to  assess  DCAA  actions 
on  recommendations  in  these  reports  and  identify  any  gaps  for  further 
action.  DCAA  has  already  taken  numerous  actions  to  respond  to  our  initial 
investigative  report  as  well  as  DOD  Comptroller/CFO  and  DBB 
recommendations. 


Longer-term  actions  In  the  longer  term,  Congress  could  consider  changes  in  DCAA’s 

organizational  placement.  However,  moving  DCAA  as  an  organization  or 
establishing  a  new  federal  contract  audit  agency  would  require  careful 
analysis  and  planning  before  implementation.  For  example,  numerous 
governmentwide  acquisition  management  reform  efforts  are  currently 
under  way  that  could  impact  the  contract  audit  function.  These  efforts 
include  congressional  oversight  and  reform  legislation  and  Presidential 
direction  on  developing  governmentwide  guidance  for  reviews  of  existing 
contracts  to  identify  contracts  that  are  wasteful,  inefficient,  or  otherwise 
unlikely  to  meet  agencies’  needs,  and  to  formulate  corrective  action  in  a 
timely  manner,  as  well  as  interest  group  studies. 

Depending  on  the  outcome  of  the  various  contract  reform  initiatives  and 
the  successful  implementation  of  DCAA  management  reforms,  Congress 
may  also  want  to  consider  increasing  the  efficacy  of  these  reforms  by 
establishing  an  independent  governmentwide  contract  audit  agency.  The 
creation  of  a  statutory  govemmentwide  contract  audit  agency  could 
enhance  contract  auditor  effectiveness  and  independence  by  placing  the 
audit  agency  outside  DOD  and  other  federal  agencies  that  make 
procurement  and  contract  management  decisions.  Centralizing  the 
contract  audit  function  and  mandating  its  use  by  all  federal  agencies  also 
could  provide  for  consistent  audit  coverage  and  bring  efficiencies  and 
economies  of  scale  to  the  contract  audit  process  across  the  government. 
However,  our  2009  report  cautioned  that  this  would  likely  entail  significant 
costs  and  operational  and  accountability  considerations  and  would  be  an 
extremely  costly  option  involving  significant  infrastructure  and 
reorganization  and  would  require  substantial  planning  and  analysis  before 
deciding  whether  to  proceed  and  how  to  implement  any  changes.  Some  of 
the  issues  that  would  need  further  study  and  analysis  include  the 
following: 

Governance.  Governance  is  the  framework  of  rules  and  practices  by 
which  a  governing  body,  such  as  a  board  of  directors,  ensures 
accountability,  fairness,  and  transparency  in  the  entity’s  relationship  with 
all  of  its  stakeholders,  including  management,  employees,  and 
government.  In  order  to  improve  governance  and  accountability  at  federal 


Page  26 


GAO-11-331T 


agencies,  a  variety  of  laws  covering  a  range  of  management  and 
administrative  practices  and  processes  have  been  enacted.  Consideration 
of  such  provisions  for  a  govemmentwide  contract  audit  agency  should 
include  application  of  general  laws  related  to  funds  control,  performance 
and  financial  reporting,  accounting  and  internal  control  systems,  human 
resources  management,  and  recordkeeping  and  access  to  information, 
among  others.  Further,  governance  issues  unique  to  a  contract  audit 
agency,  such  as  its  relationships  to  agency  contracting  officers  and  the 
Congress,  should  be  assessed. 

Scope  of  Work.  Scope  of  work  considerations  would  include  roles, 
responsibilities,  and  relationships  of  the  govemmentwide  contract  audit 
agency  and  IGs  with  regard  to  contract  audits.  Another  consideration 
would  be  whether  the  new  agency  would  be  available  for  consultation  as 
an  outside  expert  on  federal  agency  preaward  issues.  In  addition,  a 
determination  would  need  to  be  made  on  the  handling  of  fraud  referrals. 
For  example,  the  central  new  agency  could  have  an  investigative  division 
or  it  could  refer  potential  contract  fraud  to  federal  agency  IGs  for  further 
investigation. 

Funding.  Congress  would  need  to  determine  how  to  fund  the  new 
contract  audit  agency.  For  example,  funding  could  be  provided  through 
appropriations  or  from  reimbursement  by  federal  agencies.  This  decision 
would  likely  be  tied  to  decisions  on  the  governmentwide  contract  audit 
agency’s  mandate  and  scope  of  work  and  any  realignment  of  contract 
audit  resources. 

Further  study  and  analysis  of  this  potential  action  would  involve  input 
from  the  federal  agency  IGs  and  agency  contracting  and  finance 
communities  as  well  as  government  contractors  and  public  interest 
groups.  Numerous  additional  issues  would  potentially  be  identified  and 
require  substantial  time  and  cost  for  effective  consideration  and 
resolution. 
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